fix(auth): harden post-login redirect validation

fix(auth): harden post-login redirect validation #178